code-auditor-mcp 3.10.0 → 4.0.1

package/dist/pipelineAdapters.js

@@ -19,19 +19,27 @@ import { createHash } from 'crypto';
 import path from 'path';
 import { RULE_REGISTRY } from './analyzers/ruleRegistry.js';
 import { TYPESCRIPT_EXTENSIONS, JAVASCRIPT_EXTENSIONS, getLanguageFromPath } from './utils/fileDiscovery.js';
-import { walkAST, isExported, getLineAndColumn, calculateComplexity, getFunctionBody, } from './languages/adapterBridge.js';
+import { walkAST, isExported, getNodeText, getFieldNode, getLineAndColumn, calculateComplexity, getFunctionBody, } from './languages/adapterBridge.js';
 import { buildImportMap, extractFunctionCalls, } from './utils/dependencyExtractor.js';
-import { resolveDependency, basenameNoExt } from './graph/importGraph.js';
+import { classifyImportSpecifier, DEFAULT_VIRTUAL_MODULES } from './graph/importClassification.js';
 import { isReactComponent, detectComponentType, getComponentName, } from './utils/reactDetection.js';
 import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, checkUnresolvedQueries, getNearestTableSuggestions, } from './analyzers/universal/schema/codeAnalysis.js';
 import { passesFileGate, extractTablesFromRegistry, } from './analyzers/universal/schema/discovery.js';
-import { applyMigrationOps } from './analyzers/universal/schema/migrations.js';
+import { applyMigrationOps, stripIdentifier } from './analyzers/universal/schema/migrations.js';
 // ── Rule ID helpers ──────────────────────────────────────────────────────────
 function getRuleIdsFor(name) {
     return Object.entries(RULE_REGISTRY)
         .filter(([, entry]) => entry.analyzer === name)
         .map(([id]) => id);
 }
+/** Join a list of names as prose: "a", "a and b", "a, b and c". */
+function joinEnglish(names) {
+    if (names.length === 0)
+        return '';
+    if (names.length === 1)
+        return names[0];
+    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+}
 // ── Lazy import singleton ────────────────────────────────────────────────────
 function lazySingleton(loader) {
     let promise = null;
@@ -153,10 +161,6 @@ function computeContentHash(body, signature) {
     const normalized = (body ?? '').replace(/\s+/g, ' ').trim() + '|' + (signature ?? '').trim();
     return createHash('sha256').update(normalized).digest('hex');
 }
-/** Raw text from an ASTNode (tree-sitter node stored on `.raw`). */
-function rawText(node) {
-    return node.raw?.text ?? '';
-}
 export function createFunctionIndexVisitor() {
     return {
         name: 'function-index',
@@ -177,8 +181,18 @@ export function createFunctionIndexVisitor() {
                 table: 'functions',
                 data: { _action: 'clear-by-file', file_path: filePath },
             });
+            // Spec 60 — import classification is TS/JS-only: the normalization probe
+            // list has no `.go` extension, so applying it to Go relative imports would
+            // manufacture false `internal-broken` rows. Clear + re-emit only for TS/JS.
+            const isTsJs = lang === 'typescript' || lang === 'javascript';
+            if (isTsJs) {
+                indexFacts.push({
+                    table: 'import_specifiers',
+                    data: { _action: 'clear-by-file', file_path: filePath },
+                });
+            }
             // Build import map once per file for resolving call targets
-            const importMap = buildImportMap(root);
+            const importMap = buildImportMap(root, sourceCode);
             // Collect function-like nodes in two passes:
             //  1) function_declaration + method_definition nodes
             //  2) arrow functions assigned to variables (variable_declarator children)
@@ -189,12 +203,11 @@ export function createFunctionIndexVisitor() {
                     const nameNode = node.children?.find((c) => c.type === 'identifier');
                     if (!nameNode)
                         return;
-                    const name = rawText(nameNode);
+                    const name = getNodeText(nameNode, sourceCode);
                     if (!name)
                         return;
                     const { line } = getLineAndColumn(node);
-                    const raw = node.raw;
-                    const endLine = line + (raw?.endPosition?.row ?? raw?.startPosition?.row ?? 0) - (raw?.startPosition?.row ?? line) + 1;
+                    const endLine = node.location.end.line;
                     const body = getFunctionBody(node, sourceCode);
                     const calls = extractFunctionCalls(node, sourceCode, importMap);
                     const callNames = [...new Set(calls.map((c) => c.callee))];
@@ -215,7 +228,7 @@ export function createFunctionIndexVisitor() {
                     const nameNode = node.children?.find((c) => c.type === 'identifier');
                     if (!nameNode)
                         return;
-                    const methodName = rawText(nameNode);
+                    const methodName = getNodeText(nameNode, sourceCode);
                     if (!methodName)
                         return;
                     // Walk up to find class name
@@ -225,14 +238,13 @@ export function createFunctionIndexVisitor() {
                         if (parent.type === 'class_declaration') {
                             const cn = parent.children?.find((c) => c.type === 'identifier');
                             if (cn)
-                                className = rawText(cn);
+                                className = getNodeText(cn, sourceCode);
                             break;
                         }
                         parent = parent.parent;
                     }
                     const { line } = getLineAndColumn(node);
-                    const raw = node.raw;
-                    const endLine = line + (raw?.endPosition?.row ?? raw?.startPosition?.row ?? 0) - (raw?.startPosition?.row ?? line) + 1;
+                    const endLine = node.location.end.line;
                     const body = getFunctionBody(node, sourceCode);
                     const calls = extractFunctionCalls(node, sourceCode, importMap);
                     const callNames = [...new Set(calls.map((c) => c.callee))];
@@ -257,14 +269,13 @@ export function createFunctionIndexVisitor() {
                 const arrowFunc = node.children?.find((c) => c.type === 'arrow_function');
                 if (!nameNode || !arrowFunc)
                     return;
-                const name = rawText(nameNode);
+                const name = getNodeText(nameNode, sourceCode);
                 if (!name)
                     return;
                 // Don't duplicate if already covered as function_declaration
                 // (shouldn't happen — function_declaration is a different node type)
                 const { line } = getLineAndColumn(arrowFunc);
-                const raw = arrowFunc.raw;
-                const endLine = line + (raw?.endPosition?.row ?? raw?.startPosition?.row ?? 0) - (raw?.startPosition?.row ?? line) + 1;
+                const endLine = arrowFunc.location.end.line;
                 const body = getFunctionBody(arrowFunc, sourceCode);
                 const calls = extractFunctionCalls(arrowFunc, sourceCode, importMap);
                 const callNames = [...new Set(calls.map((c) => c.callee))];
@@ -290,12 +301,12 @@ export function createFunctionIndexVisitor() {
                 filePath.endsWith('.jsx') ||
                 (filePath.endsWith('.js') && hasReactImport)) {
                 walkAST(root, (node) => {
-                    if (!isReactComponent(node))
+                    if (!isReactComponent(node, sourceCode))
                         return;
-                    const ct = detectComponentType(node);
+                    const ct = detectComponentType(node, sourceCode);
                     if (!ct)
                         return;
-                    const cName = getComponentName(node);
+                    const cName = getComponentName(node, sourceCode);
                     if (!cName || cName === 'AnonymousComponent')
                         return;
                     const existing = fnEntries.find((f) => f.name === cName);
@@ -308,11 +319,7 @@ export function createFunctionIndexVisitor() {
                         // New entry — class component, function_expression, or memo/forwardRef
                         // wrapper not already captured by passes 1 or 2.
                         const { line } = getLineAndColumn(node);
-                        const raw = node.raw;
-                        const endLine = line +
-                            (raw?.endPosition?.row ?? raw?.startPosition?.row ?? 0) -
-                            (raw?.startPosition?.row ?? line) +
-                            1;
+                        const endLine = node.location.end.line;
                         const body = getFunctionBody(node, sourceCode);
                         fnEntries.push({
                             name: cName,
@@ -335,7 +342,6 @@ export function createFunctionIndexVisitor() {
                     isExported: fn.isExported,
                     complexity: fn.complexity,
                     functionCalls: fn.functionCalls,
-                    body: fn.body,
                 };
                 const contentHash = computeContentHash(fn.body, '');
                 const now = new Date().toISOString();
@@ -379,29 +385,66 @@ export function createFunctionIndexVisitor() {
                 isRequire: false,
                 line: imp.location.start.line,
             }));
+            // Spec 60.1 — classify each static import specifier and emit one row per
+            // occurrence to `import_specifiers`. The corpus file set is the stage-1
+            // discovery list, threaded here as `_infra.files` (merged into
+            // `context.config` by pipeline.ts). Existence is checked against that
+            // in-memory set, never `fs.existsSync`. Virtual-module list + tsconfig
+            // `paths` patterns are threaded via `_infra` and passed to the classifier.
+            if (isTsJs) {
+                // Spec 60.1 Correction 1 — corpus set is the unfiltered discovery list
+                // (`_infra.corpusFiles`), not the narrowed `_infra.files`. The latter is
+                // the audit's analysis list (already pruned by includePaths/excludePaths),
+                // which drops `.json`/other non-analyzed extensions and would mis-classify
+                // a real `./invariant-rules.schema.json` as `internal-broken`.
+                const corpusFiles = new Set((context.config.corpusFiles) ??
+                    (context.config.files) ??
+                    []);
+                const virtualModules = context.config.importVirtualModules
+                    ?? DEFAULT_VIRTUAL_MODULES;
+                const tsconfigAliases = context.config.tsconfigAliases;
+                for (const imp of staticImportInfos) {
+                    const { classification, resolvedPath } = classifyImportSpecifier(imp.source, filePath, corpusFiles, {
+                        virtualModules,
+                        aliasPatterns: tsconfigAliases?.pathPatterns ?? [],
+                        pathMappings: tsconfigAliases?.paths ?? {},
+                        baseUrl: tsconfigAliases?.baseUrl,
+                        projectRoot: context.projectRoot,
+                    });
+                    indexFacts.push({
+                        table: 'import_specifiers',
+                        data: {
+                            file_path: filePath,
+                            specifier: imp.source,
+                            classification,
+                            resolved_path: resolvedPath ?? null,
+                            line: imp.location.start.line,
+                        },
+                        conflictKey: 'file_path, specifier, line',
+                    });
+                }
+            }
             // Dynamic import() and require() — first attempt with pure NodePattern
             // Plan note: import keyword is an anonymous tree-sitter node, so
             // hasChild cannot see it.  We use `custom` with raw node access.
             const dynamicCallNodes = langAdapter.findNodes(langAst, {
                 type: 'call_expression',
                 custom: (node) => {
-                    const raw = node.raw;
-                    const fn = raw?.firstChild;
+                    const fn = node.children?.[0];
                     return (fn?.type === 'import') ||
-                        (fn?.type === 'identifier' && fn.text === 'require');
+                        (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
                 },
             });
             const dynamicImports = [];
             for (const node of dynamicCallNodes) {
-                const raw = node.raw;
-                const fn = raw?.firstChild;
+                const fn = node.children?.[0];
                 const isImport = fn?.type === 'import';
-                const isRequire = !isImport && (fn?.type === 'identifier' && fn.text === 'require');
-                // Walk the raw tree to find the string argument
-                const argsNode = raw?.children?.find((c) => c.type === 'arguments');
+                const isRequire = !isImport && (fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require');
+                // Walk the AST children to find the string argument
+                const argsNode = node.children?.find((c) => c.type === 'arguments');
                 const stringNode = argsNode?.children?.find((c) => c.type === 'string');
                 if (stringNode) {
-                    const text = stringNode.text;
+                    const text = getNodeText(stringNode, sourceCode);
                     if (text.length >= 2) {
                         dynamicImports.push({
                             moduleSpecifier: text.slice(1, -1), // strip quotes
@@ -531,8 +574,8 @@ export function createStylesCssVisitor() {
                 facts: {
                     [filePath]: {
                         declarations: extractDeclarationsFromCSSAst(cssAst, cssAdapter, filePath, sourceCode),
-                        tokens: extractTokensFromCSSAst(cssAst, cssAdapter, filePath),
-                        classUsage: extractClassUsageFromCSSAst(cssAst, cssAdapter, filePath),
+                        tokens: extractTokensFromCSSAst(cssAst, cssAdapter, filePath, sourceCode),
+                        classUsage: extractClassUsageFromCSSAst(cssAst, cssAdapter, filePath, sourceCode),
                     },
                 },
             };
@@ -815,7 +858,12 @@ export function createStylesReducer() {
                 const factsConsumed = context.indexHandle.count('style_declarations')
                     + context.indexHandle.count('style_tokens')
                     + context.indexHandle.count('style_class_usage');
-                return { violations: result.violations ?? [], facts: {}, factsConsumed };
+                return {
+                    violations: result.violations ?? [],
+                    facts: {},
+                    factsConsumed,
+                    ...((result.diagnostics?.length ?? 0) > 0 && { diagnostics: result.diagnostics }),
+                };
             }
             catch {
                 return { violations: [], facts: {} };
@@ -940,35 +988,31 @@ export function createCrossDomainReducer() {
 // short-circuits with `notRunReason` BEFORE any corpus-wide work — the gate is in
 // the design, not retrofitted after the budget blows. This is the shape that made
 // the styles reducer 587ms; it must never run over a partial corpus.
-// ── Raw-node helpers (tree-sitter raw nodes are `any` here — strict is off) ──
-function clRawField(raw, field) {
-    return typeof raw?.childForFieldName === 'function' ? raw.childForFieldName(field) : null;
-}
-function clRawNamedChild(raw, type) {
-    return raw?.namedChildren?.find((c) => c.type === type) ?? null;
-}
+// ── Entity helpers (ASTNode-based; parser-specific nodes stay in languages/) ──
 /** A function body node — `statement_block` (TS/JS) or `block` (Go). */
-function clRawBody(raw) {
-    return raw?.namedChildren?.find((c) => c.type === 'statement_block' || c.type === 'block') ?? null;
+function clBody(node) {
+    return node.children?.find((c) => c.type === 'statement_block' || c.type === 'block');
 }
-function clSignatureText(raw, sourceCode) {
-    if (!raw)
-        return '';
-    const body = clRawBody(raw);
-    const end = body ? body.startIndex : raw.endIndex;
-    return sourceCode.slice(raw.startIndex, end).trim();
+function clSignatureText(node, sourceCode) {
+    const body = clBody(node);
+    const end = body ? body.range[0] : node.range[1];
+    return sourceCode.slice(node.range[0], end).trim();
 }
-function clBodyText(raw, sourceCode) {
-    const body = clRawBody(raw);
-    return body ? sourceCode.slice(body.startIndex, body.endIndex) : '';
+function clBodyText(node, sourceCode) {
+    const body = clBody(node);
+    return body ? sourceCode.slice(body.range[0], body.range[1]) : '';
 }
 /** Prefer the `name` field (works across TS + Go), fall back to identifier children. */
-function clNodeName(raw) {
-    const field = clRawField(raw, 'name');
-    if (field?.text)
-        return field.text;
-    const id = clRawNamedChild(raw, 'identifier') ?? clRawNamedChild(raw, 'property_identifier');
-    return id?.text;
+function clNodeName(node, sourceCode) {
+    const field = getFieldNode(node, 'name');
+    if (field) {
+        const text = getNodeText(field, sourceCode);
+        if (text)
+            return text;
+    }
+    const id = node.children?.find((c) => c.type === 'identifier')
+        ?? node.children?.find((c) => c.type === 'property_identifier');
+    return id ? getNodeText(id, sourceCode) : undefined;
 }
 function clEntityId(filePath, type, name, line) {
     return `${filePath}::${type}::${name}::${line}`;
@@ -977,25 +1021,20 @@ function clIsExportedGo(name) {
     return name.length > 0 && name[0] === name[0].toUpperCase();
 }
 /** Collect callee names from a function's body (TS `call_expression` / Go `call_expression`). */
-function clCollectCallees(raw) {
+function clCollectCallees(node, sourceCode) {
     const names = new Set();
-    const walk = (node) => {
-        if (!node)
-            return;
-        if (node.type === 'call_expression') {
-            const fn = typeof node.childForFieldName === 'function'
-                ? node.childForFieldName('function')
-                : null;
-            const callee = fn ?? node.namedChildren?.[0];
-            const text = callee?.text?.trim();
+    const walk = (n) => {
+        if (n.type === 'call_expression') {
+            const fn = getFieldNode(n, 'function') ?? n.children?.[0];
+            const text = fn ? getNodeText(fn, sourceCode).trim() : '';
             if (text && /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(text)) {
                 names.add(text);
             }
         }
-        for (const child of node.namedChildren ?? [])
+        for (const child of n.children ?? [])
             walk(child);
     };
-    walk(raw);
+    walk(node);
     return [...names];
 }
 /**
@@ -1007,26 +1046,20 @@ function clCollectCallees(raw) {
  * (`arr.map(singularize)`, `[missedClose, …]`) is invisible to it and leaves
  * the genuinely-referenced target looking orphaned.
  */
-function clCollectFileReferences(raw) {
+function clCollectFileReferences(node, sourceCode) {
     const names = new Set();
     const isIdentPath = (t) => /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(t);
-    const walk = (node) => {
-        if (!node)
-            return;
-        const t = node.type;
+    const walk = (n) => {
+        const t = n.type;
         if (t === 'call_expression') {
-            const fn = typeof node.childForFieldName === 'function'
-                ? node.childForFieldName('function')
-                : null;
-            const text = (fn ?? node.namedChildren?.[0])?.text?.trim();
+            const fn = getFieldNode(n, 'function') ?? n.children?.[0];
+            const text = fn ? getNodeText(fn, sourceCode).trim() : '';
             if (text && isIdentPath(text))
                 names.add(text);
         }
         else if (t === 'jsx_opening_element' || t === 'jsx_self_closing_element') {
-            const nameNode = typeof node.childForFieldName === 'function'
-                ? node.childForFieldName('name')
-                : null;
-            const text = (nameNode ?? node.namedChildren?.[0])?.text?.trim();
+            const nameNode = getFieldNode(n, 'name') ?? n.children?.[0];
+            const text = nameNode ? getNodeText(nameNode, sourceCode).trim() : '';
             if (text && isIdentPath(text))
                 names.add(text);
         }
@@ -1036,17 +1069,17 @@ function clCollectFileReferences(raw) {
             // function reference. Declaration names (`name` fields) and member
             // accesses (`property_identifier`) are separate node types and are not
             // captured here.
-            const parent = node.parent;
+            const parent = n.parent;
             if (parent && (parent.type === 'arguments' || parent.type === 'array')) {
-                const text = node.text?.trim();
+                const text = getNodeText(n, sourceCode).trim();
                 if (text && /^[A-Za-z_$][\w$]*$/.test(text))
                     names.add(text);
             }
         }
-        for (const child of node.namedChildren ?? [])
+        for (const child of n.children ?? [])
             walk(child);
     };
-    walk(raw);
+    walk(node);
     return [...names];
 }
 function clMakeFunction(filePath, lang, name, line, signature, purpose, params, callees, exported, complexity, isMethod = false) {
@@ -1077,18 +1110,21 @@ function clMakeFunction(filePath, lang, name, line, signature, purpose, params,
  * (`import(someVariable)` — unresolvable, reported rather than silenced), or
  * `null` when the call is not a dynamic import/require.
  */
-function clDynamicImport(raw) {
-    if (raw?.type !== 'call_expression')
+function clDynamicImport(node, sourceCode) {
+    if (node.type !== 'call_expression')
         return null;
-    const fn = raw.firstChild;
+    const fn = node.children?.[0];
     const isImport = fn?.type === 'import';
-    const isRequire = fn?.type === 'identifier' && fn?.text === 'require';
+    const isRequire = fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require';
     if (!isImport && !isRequire)
         return null;
-    const args = raw.children?.find((c) => c.type === 'arguments');
+    const args = node.children?.find((c) => c.type === 'arguments');
     const stringNode = args?.children?.find((c) => c.type === 'string');
-    if (stringNode && stringNode.text.length >= 2) {
-        return { specifier: stringNode.text.slice(1, -1) };
+    if (stringNode) {
+        const text = getNodeText(stringNode, sourceCode);
+        if (text.length >= 2) {
+            return { specifier: text.slice(1, -1) };
+        }
     }
     // A template literal with no `${…}` substitution is a compile-time constant,
     // not a computed specifier — `import(\`@babel/plugin-syntax-jsx\`)` resolves
@@ -1098,15 +1134,17 @@ function clDynamicImport(raw) {
     if (templateNode) {
         const hasSubstitution = (templateNode.children ?? []).some((c) => c.type === 'template_substitution');
         if (!hasSubstitution) {
-            const t = templateNode.text;
+            const t = getNodeText(templateNode, sourceCode);
             if (t.length >= 2 && t.startsWith('`') && t.endsWith('`')) {
                 return { specifier: t.slice(1, -1) };
             }
         }
     }
     // Computed specifier — the target module cannot be resolved statically.
-    const named = args?.namedChildren?.[0];
-    const expression = named?.text ?? (args?.text ?? '').replace(/^\(|\)$/g, '').trim();
+    const named = args?.children?.[0];
+    const expression = named
+        ? getNodeText(named, sourceCode)
+        : getNodeText(args, sourceCode).replace(/^\(|\)$/g, '').trim();
     return { computed: true, expression };
 }
 /**
@@ -1119,23 +1157,26 @@ function clDynamicImport(raw) {
  * names), since Go has no `export` keyword. Dynamic `import()`/`require()`
  * with a static string argument also record an import edge (Spec 58 R2).
  */
-function clCollectFileInfo(root, lang) {
+function clCollectFileInfo(root, lang, sourceCode) {
     const imports = new Set();
     const unresolvedDynamicImports = [];
     let hasExports = false;
     walkAST(root, (node) => {
-        const raw = node.raw;
         if (node.type === 'import_statement') {
-            const source = clRawField(raw, 'source');
-            if (source?.text)
-                imports.add(source.text.replace(/^['"]|['"]$/g, ''));
+            const source = getFieldNode(node, 'source');
+            if (source) {
+                const text = getNodeText(source, sourceCode);
+                imports.add(text.replace(/^['"]|['"]$/g, ''));
+            }
         }
         else if (node.type === 'import_declaration') {
-            for (const spec of raw?.namedChildren ?? []) {
+            for (const spec of node.children ?? []) {
                 if (spec.type === 'import_spec') {
-                    const p = clRawField(spec, 'path');
-                    if (p?.text)
-                        imports.add(p.text.replace(/^['"]|['"]$/g, ''));
+                    const p = getFieldNode(spec, 'path');
+                    if (p) {
+                        const text = getNodeText(p, sourceCode);
+                        imports.add(text.replace(/^['"]|['"]$/g, ''));
+                    }
                 }
             }
         }
@@ -1144,109 +1185,113 @@ function clCollectFileInfo(root, lang) {
             // Re-exports (`export { x } from './y'`, `export * from './y'`) are import
             // edges for reachability: a barrel re-exporting a module marks it live,
             // not dead. The `source` field is present only on the `from` form.
-            const source = clRawField(raw, 'source');
-            if (source?.text)
-                imports.add(source.text.replace(/^['"]|['"]$/g, ''));
+            const source = getFieldNode(node, 'source');
+            if (source) {
+                const text = getNodeText(source, sourceCode);
+                imports.add(text.replace(/^['"]|['"]$/g, ''));
+            }
         }
         else if (node.type === 'call_expression') {
-            const dyn = clDynamicImport(raw);
+            const dyn = clDynamicImport(node, sourceCode);
             if (dyn && 'specifier' in dyn) {
                 imports.add(dyn.specifier);
             }
             else if (dyn) {
-                unresolvedDynamicImports.push({ line: (raw?.startPosition?.row ?? 0) + 1, expression: dyn.expression });
+                unresolvedDynamicImports.push({ line: node.location.start.line, expression: dyn.expression });
             }
         }
     });
     return { imports: [...imports], hasExports, unresolvedDynamicImports };
 }
 // ── TS/JS extraction ─────────────────────────────────────────────────────────
-function clExtractTSParams(raw) {
+function clExtractTSParams(node, sourceCode) {
     const params = [];
-    const formal = clRawNamedChild(raw, 'formal_parameters');
-    for (const p of formal?.namedChildren ?? []) {
+    const formal = node.children?.find((c) => c.type === 'formal_parameters');
+    for (const p of formal?.children ?? []) {
         if (p.type !== 'required_parameter' && p.type !== 'optional_parameter')
             continue;
-        const name = clRawField(p, 'name')?.text ?? clRawNamedChild(p, 'identifier')?.text;
+        const nameNode = getFieldNode(p, 'name') ?? p.children?.find((c) => c.type === 'identifier');
+        const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
         if (!name)
             continue;
-        const type = clRawField(p, 'type')?.text?.trim();
+        const typeNode = getFieldNode(p, 'type');
+        const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
         params.push({ name, type, optional: p.type === 'optional_parameter', language: 'typescript' });
     }
     return params;
 }
-function clExtractTSInterfaceParams(raw) {
+function clExtractTSInterfaceParams(node, sourceCode) {
     const params = [];
-    const walk = (node) => {
-        if (!node)
-            return;
-        if (node.type === 'property_signature') {
-            const name = clRawField(node, 'name')?.text ?? clRawNamedChild(node, 'property_identifier')?.text;
+    const walk = (n) => {
+        if (n.type === 'property_signature') {
+            const nameNode = getFieldNode(n, 'name') ?? n.children?.find((c) => c.type === 'property_identifier');
+            const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
             if (!name)
                 return;
-            const type = clRawField(node, 'type')?.text?.trim();
-            const optional = node.children?.some((c) => c.type === '?') ?? false;
+            const typeNode = getFieldNode(n, 'type');
+            const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
+            const optional = n.children?.some((c) => c.type === '?') ?? false;
             params.push({ name, type, optional, language: 'typescript' });
         }
-        for (const child of node.namedChildren ?? [])
+        for (const child of n.children ?? [])
             walk(child);
     };
-    walk(raw);
+    walk(node);
     return params;
 }
 function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
-    const fileReferences = clCollectFileReferences(root.raw);
+    const fileReferences = clCollectFileReferences(root, sourceCode);
     walkAST(root, (node) => {
-        const raw = node.raw;
         if (node.type === 'function_declaration' || node.type === 'method_definition') {
-            const name = clNodeName(raw);
+            const name = clNodeName(node, sourceCode);
             if (!name)
                 return;
             let displayName = name;
             if (node.type === 'method_definition') {
-                let p = raw?.parent;
+                let p = node.parent ?? null;
                 while (p) {
                     if (p.type === 'class_declaration') {
-                        const cn = clNodeName(p);
+                        const cn = clNodeName(p, sourceCode);
                         if (cn)
                             displayName = `${cn}.${name}`;
                         break;
                     }
-                    p = p.parent;
+                    p = p.parent ?? null;
                 }
             }
-            const line = (raw?.startPosition?.row ?? 0) + 1;
-            const entity = clMakeFunction(filePath, lang, displayName, line, clSignatureText(raw, sourceCode) || raw?.text || '', clBodyText(raw, sourceCode), clExtractTSParams(raw), clCollectCallees(raw), isExported(node), calculateComplexity(node), node.type === 'method_definition');
+            const line = node.location.start.line;
+            const entity = clMakeFunction(filePath, lang, displayName, line, clSignatureText(node, sourceCode) || getNodeText(node, sourceCode), clBodyText(node, sourceCode), clExtractTSParams(node, sourceCode), clCollectCallees(node, sourceCode), isExported(node), calculateComplexity(node), node.type === 'method_definition');
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
         }
         if (node.type === 'variable_declarator') {
-            const arrow = clRawNamedChild(raw, 'arrow_function');
+            const arrow = node.children?.find((c) => c.type === 'arrow_function');
             if (!arrow)
                 return;
-            const name = clRawNamedChild(raw, 'identifier')?.text;
+            const nameNode = node.children?.find((c) => c.type === 'identifier');
+            const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
             if (!name)
                 return;
-            const line = (raw?.startPosition?.row ?? 0) + 1;
-            const entity = clMakeFunction(filePath, lang, name, line, clSignatureText(arrow, sourceCode) || arrow?.text || '', clBodyText(arrow, sourceCode), [], clCollectCallees(arrow), isExported(node), calculateComplexity(node));
+            const line = node.location.start.line;
+            const entity = clMakeFunction(filePath, lang, name, line, clSignatureText(arrow, sourceCode) || getNodeText(arrow, sourceCode), clBodyText(arrow, sourceCode), [], clCollectCallees(arrow, sourceCode), isExported(node), calculateComplexity(node));
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
         }
         if (node.type === 'interface_declaration') {
-            const name = clNodeName(raw);
+            const name = clNodeName(node, sourceCode);
             if (!name)
                 return;
-            const line = (raw?.startPosition?.row ?? 0) + 1;
+            const line = node.location.start.line;
             out.push({
                 id: clEntityId(filePath, 'interface', name, line),
                 name,
                 language: lang,
                 file: filePath,
                 type: 'interface',
-                signature: raw?.text ?? '',
-                parameters: clExtractTSInterfaceParams(raw),
+                signature: getNodeText(node, sourceCode),
+                parameters: clExtractTSInterfaceParams(node, sourceCode),
                 startLine: line,
                 visibility: isExported(node) ? 'public' : 'private',
                 calls: [],
@@ -1261,70 +1306,75 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
     });
 }
 // ── Go extraction ────────────────────────────────────────────────────────────
-function clGoReceiverType(receiver) {
-    for (const child of receiver?.namedChildren ?? []) {
+function clGoReceiverType(receiver, sourceCode) {
+    for (const child of receiver.children ?? []) {
         if (child.type === 'parameter_declaration') {
-            const typeNode = clRawField(child, 'type');
+            const typeNode = getFieldNode(child, 'type');
             if (typeNode)
-                return typeNode.text.replace(/^\*/, '');
+                return getNodeText(typeNode, sourceCode).replace(/^\*/, '');
         }
     }
     return undefined;
 }
-function clExtractGoParams(raw) {
+function clExtractGoParams(node, sourceCode) {
     const params = [];
-    const paramList = clRawField(raw, 'parameters');
-    for (const p of paramList?.namedChildren ?? []) {
+    const paramList = getFieldNode(node, 'parameters');
+    for (const p of paramList?.children ?? []) {
         if (p.type !== 'parameter_declaration')
             continue;
-        const name = clRawField(p, 'name')?.text ?? clRawField(p, 'type')?.text;
-        const type = clRawField(p, 'type')?.text?.trim();
+        const nameNode = getFieldNode(p, 'name') ?? getFieldNode(p, 'type');
+        const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
+        const typeNode = getFieldNode(p, 'type');
+        const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
         if (!name && !type)
             continue;
         params.push({ name: name ?? type ?? '<unknown>', type, optional: false, language: 'go' });
     }
     return params;
 }
-function clExtractGoStructFields(structNode) {
+function clExtractGoStructFields(structNode, sourceCode) {
     const fields = [];
-    for (const f of structNode?.namedChildren ?? []) {
+    for (const f of structNode.children ?? []) {
         if (f.type !== 'field_declaration')
             continue;
-        const name = clRawField(f, 'name')?.text;
+        const nameNode = getFieldNode(f, 'name');
+        const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
         if (!name)
             continue;
-        const type = clRawField(f, 'type')?.text?.trim();
-        const tag = clRawField(f, 'tag')?.text;
+        const typeNode = getFieldNode(f, 'type');
+        const type = typeNode ? getNodeText(typeNode, sourceCode).trim() : undefined;
+        const tagNode = getFieldNode(f, 'tag');
+        const tag = tagNode ? getNodeText(tagNode, sourceCode) : undefined;
         fields.push({ name, type, isExported: clIsExportedGo(name), tag });
     }
     return fields;
 }
 function clExtractGoEntities(root, filePath, sourceCode, out) {
-    const fileReferences = clCollectFileReferences(root.raw);
+    const fileReferences = clCollectFileReferences(root, sourceCode);
     walkAST(root, (node) => {
-        const raw = node.raw;
         if (node.type === 'function_declaration') {
-            const name = clNodeName(raw);
+            const name = clNodeName(node, sourceCode);
             if (!name)
                 return;
-            const receiver = clRawField(raw, 'receiver');
-            const receiverType = receiver ? clGoReceiverType(receiver) : undefined;
+            const receiver = getFieldNode(node, 'receiver');
+            const receiverType = receiver ? clGoReceiverType(receiver, sourceCode) : undefined;
             const displayName = receiverType ? `${receiverType}.${name}` : name;
-            const line = (raw?.startPosition?.row ?? 0) + 1;
-            const entity = clMakeFunction(filePath, 'go', displayName, line, clSignatureText(raw, sourceCode) || raw?.text || '', clBodyText(raw, sourceCode), clExtractGoParams(raw), clCollectCallees(raw), clIsExportedGo(name), calculateComplexity(node));
+            const line = node.location.start.line;
+            const entity = clMakeFunction(filePath, 'go', displayName, line, clSignatureText(node, sourceCode) || getNodeText(node, sourceCode), clBodyText(node, sourceCode), clExtractGoParams(node, sourceCode), clCollectCallees(node, sourceCode), clIsExportedGo(name), calculateComplexity(node));
             entity.metadata.fileReferences = fileReferences;
             out.push(entity);
             return;
         }
         if (node.type === 'type_declaration') {
-            for (const spec of raw?.namedChildren ?? []) {
+            for (const spec of node.children ?? []) {
                 if (spec.type !== 'type_spec')
                     continue;
-                const name = clRawField(spec, 'name')?.text;
+                const nameNode = getFieldNode(spec, 'name');
+                const name = nameNode ? getNodeText(nameNode, sourceCode) : undefined;
                 if (!name)
                     continue;
-                const typeNode = clRawField(spec, 'type');
-                const line = (spec?.startPosition?.row ?? 0) + 1;
+                const typeNode = getFieldNode(spec, 'type');
+                const line = spec.location.start.line;
                 if (typeNode?.type === 'struct_type') {
                     out.push({
                         id: clEntityId(filePath, 'struct', name, line),
@@ -1332,7 +1382,7 @@ function clExtractGoEntities(root, filePath, sourceCode, out) {
                         language: 'go',
                         file: filePath,
                         type: 'struct',
-                        signature: spec?.text ?? '',
+                        signature: getNodeText(spec, sourceCode),
                         parameters: [],
                         startLine: line,
                         visibility: clIsExportedGo(name) ? 'public' : 'private',
@@ -1341,7 +1391,7 @@ function clExtractGoEntities(root, filePath, sourceCode, out) {
                         purpose: '',
                         context: '',
                         searchTokens: [name.toLowerCase()],
-                        metadata: { fields: clExtractGoStructFields(typeNode) },
+                        metadata: { fields: clExtractGoStructFields(typeNode, sourceCode) },
                     });
                 }
                 else if (typeNode?.type === 'interface_type') {
@@ -1351,7 +1401,7 @@ function clExtractGoEntities(root, filePath, sourceCode, out) {
                         language: 'go',
                         file: filePath,
                         type: 'interface',
-                        signature: spec?.text ?? '',
+                        signature: getNodeText(spec, sourceCode),
                         parameters: [],
                         startLine: line,
                         visibility: clIsExportedGo(name) ? 'public' : 'private',
@@ -1390,7 +1440,7 @@ export function createCrossLanguageEntityVisitor() {
             else {
                 clExtractTSEntities(root, filePath, sourceCode, lang, entities);
             }
-            const fileInfo = clCollectFileInfo(root, lang);
+            const fileInfo = clCollectFileInfo(root, lang, sourceCode);
             // Go has no `export` keyword — an exported symbol is a capitalized
             // top-level name, which the entity extractor already records as public.
             const hasExports = lang === 'go'
@@ -1464,27 +1514,35 @@ function clIsEntryPointFile(fp) {
         return true;
     return false;
 }
+/** Resolve one import specifier to zero or one internal file via the classifier. */
+function clResolveImport(dep, sourceFile, options) {
+    const { classification, resolvedPath } = classifyImportSpecifier(dep, sourceFile, options.corpusFiles, {
+        virtualModules: options.virtualModules,
+        aliasPatterns: options.tsconfigAliases?.pathPatterns ?? [],
+        pathMappings: options.tsconfigAliases?.paths ?? {},
+        baseUrl: options.tsconfigAliases?.baseUrl,
+        projectRoot: options.projectRoot,
+    });
+    if (classification === 'internal-resolved' && resolvedPath)
+        return [resolvedPath];
+    return [];
+}
 /**
  * Compute file-level reachability from per-file imports.
  *
  * A file is a framework entry point (live → 1.0), imported by another file
- * (live → 0.5), or referenced by nothing (dead → 0.0). The resolver mirrors
- * importGraph.ts and handles relative paths, npm/alias basenames, and fuzzy
- * path-segment matches.
+ * (live → 0.5), or referenced by nothing (dead → 0.0). Resolution goes through
+ * `classifyImportSpecifier` (relative paths and tsconfig `paths` aliases like
+ * `@/`) instead of the legacy basename/fuzzy matcher, so an alias import creates
+ * a real edge and a bare package import never fabricates a local one.
  */
-function clComputeReachability(fileFacts) {
+function clComputeReachability(fileFacts, options) {
     const filePaths = new Set(fileFacts.keys());
-    const moduleToFile = new Map();
-    for (const fp of filePaths) {
-        const bn = basenameNoExt(fp);
-        if (!moduleToFile.has(bn))
-            moduleToFile.set(bn, new Set());
-        moduleToFile.get(bn).add(fp);
-    }
+    const packageEntries = options.packageEntryPoints ?? new Set();
     const importersOf = new Map();
     for (const [fp, info] of fileFacts) {
         for (const dep of info.imports) {
-            const targets = resolveDependency(dep, filePaths, moduleToFile, fp);
+            const targets = clResolveImport(dep, fp, options);
             for (const t of targets) {
                 if (t === fp)
                     continue;
@@ -1496,7 +1554,7 @@ function clComputeReachability(fileFacts) {
     }
     const reachability = new Map();
     for (const fp of filePaths) {
-        const entry = clIsEntryPointFile(fp);
+        const entry = clIsEntryPointFile(fp) || packageEntries.has(fp);
         const imported = (importersOf.get(fp)?.size ?? 0) > 0;
         reachability.set(fp, entry ? 1 : imported ? 0.5 : 0);
     }
@@ -1717,7 +1775,18 @@ export function createDependencyGraphReducer() {
                 // ── File-level reachability: unreferenced modules + ranking axis ──
                 const fileFacts = clFileFacts(allFacts);
                 if (fileFacts.size > 0) {
-                    const { reachability, importersOf } = clComputeReachability(fileFacts);
+                    // `context.config` is the reducer's merged config (namespace + `_infra`);
+                    // a bare reducer context in a unit test omits it, so fall back to the
+                    // file facts themselves as the corpus and a no-alias classification.
+                    const infraConfig = (context.config ?? {});
+                    const packageEntrySet = new Set(infraConfig.packageEntryPoints ?? []);
+                    const { reachability, importersOf } = clComputeReachability(fileFacts, {
+                        corpusFiles: new Set(infraConfig.corpusFiles ?? [...fileFacts.keys()]),
+                        virtualModules: infraConfig.importVirtualModules ?? DEFAULT_VIRTUAL_MODULES,
+                        tsconfigAliases: infraConfig.tsconfigAliases,
+                        packageEntryPoints: packageEntrySet,
+                        projectRoot: context.projectRoot ?? '',
+                    });
                     // Persist reachability to graph_cache so the post-pipeline reorder
                     // (auditRunner hotspot block) can rank every finding by live/dead.
                     if (context.indexHandle?.rawDb) {
@@ -1747,7 +1816,7 @@ export function createDependencyGraphReducer() {
                             continue;
                         if (clIsTestFile(fp))
                             continue;
-                        if (clIsEntryPointFile(fp))
+                        if (clIsEntryPointFile(fp) || packageEntrySet.has(fp))
                             continue;
                         if ((importersOf.get(fp)?.size ?? 0) > 0)
                             continue;
@@ -1785,15 +1854,15 @@ export function createDependencyGraphReducer() {
                 }
                 const HEALTH_SEVERITY = {
                     'break-cycles': 'severe',
-                    'reduce-coupling': 'high',
-                    'split-responsibilities': 'high',
+                    'reduce-coupling': 'advisory',
+                    'split-responsibilities': 'advisory',
                     'review-orphans': 'severe',
                 };
                 for (const s of health.suggestions) {
                     violations.push({
                         file: '(multiple)',
                         line: 0,
-                        severity: HEALTH_SEVERITY[s.type] ?? 'high',
+                        severity: HEALTH_SEVERITY[s.type] ?? 'advisory',
                         message: s.description,
                         rule: s.type,
                         type: s.type,
@@ -2029,7 +2098,7 @@ export function createSchemaCodeVisitor() {
             // Find table references (per-file, uses allTables for short-id false-positive filtering)
             const { references: tableRefs, unresolved } = findTableReferences(ast, adapter, sourceCode, { config: schemaConfig, provenanceContext, allTables });
             // Record schema usage → emit as indexFacts via the shared instance
-            a.recordTableUsage(ast, adapter, context.filePath, tableRefs);
+            a.recordTableUsage(ast, adapter, context.filePath, tableRefs, sourceCode);
             const pending = a.getPendingSchemaRecords();
             // Emit clear-by-file + per-usage index facts
             if (pending.clearFiles.length > 0) {
@@ -2044,10 +2113,13 @@ export function createSchemaCodeVisitor() {
                         file_path: usage.filePath,
                         table_name: usage.tableName,
                         function_name: usage.functionName,
+                        function_start_line: usage.functionStartLine,
+                        function_start_column: usage.functionStartColumn,
                         usage_type: usage.usageType,
                         line: usage.line,
                         column: usage.column,
                         raw_query: usage.rawQuery,
+                        origin: usage.origin ?? null,
                     },
                 });
             }
@@ -2066,9 +2138,14 @@ export function createSchemaCodeVisitor() {
             }
             // Check SQL injection
             violations.push(...checkSQLInjection(ast, adapter, sourceCode));
-            // Emit facts for the Stage 3 reducer
+            // Emit facts for the Stage 3 reducer. Fluent-builder references
+            // (`origin: 'query-builder'`) are excluded from the unknown-table check:
+            // a scratch/test table name carried by `db('t').select(...)` is not a
+            // schema catalog miss, and feeding it in flips the 10:1 fail-open ratio.
             const fileFacts = {
-                tableRefs: tableRefs.map((r) => ({
+                tableRefs: tableRefs
+                    .filter((r) => r.origin !== 'query-builder')
+                    .map((r) => ({
                     table: r.table,
                     type: r.type,
                     line: r.location.line,
@@ -2218,6 +2295,12 @@ export function createSchemaReducer() {
                     return na - nb;
                 return a.filePath.localeCompare(b.filePath);
             });
+            // Drop provenance — the last migration that removed a table, and the tables
+            // that same migration introduced. Lets unknown-table detection distinguish
+            // "never existed" from "existed and was dropped": the latter is a stale code
+            // reference, not a typo. `dropProvenance` ends up holding exactly the tables
+            // dropped and not subsequently recreated (CREATE clears the entry).
+            const dropProvenance = new Map();
             for (const sqlFile of sqlFiles) {
                 const before = new Set(knownTables);
                 applyMigrationOps(sqlFile.ops, knownTables);
@@ -2229,6 +2312,46 @@ export function createSchemaReducer() {
                         tableProvenances.set(table, sources);
                     }
                 }
+                // Genuinely-new tables introduced by this migration (excludes rename/rebuild
+                // churn like `ALTER … RENAME TO x_old` + re-CREATE of the same name).
+                const createdHere = [];
+                const createdTables = new Set();
+                const droppedTables = new Set();
+                for (const op of sqlFile.ops) {
+                    const t = stripIdentifier(op.table);
+                    if (op.op === 'CREATE') {
+                        createdTables.add(t);
+                        if (!before.has(t))
+                            createdHere.push(t);
+                    }
+                    else if (op.op === 'DROP') {
+                        droppedTables.add(t);
+                    }
+                }
+                for (const op of sqlFile.ops) {
+                    const t = stripIdentifier(op.table);
+                    if (op.op === 'DROP') {
+                        dropProvenance.set(t, { migrationFile: sqlFile.filePath, createdInSameMigration: createdHere });
+                    }
+                    else if (op.op === 'CREATE') {
+                        dropProvenance.delete(t);
+                    }
+                }
+                // A table created and dropped within this same file is a self-contained
+                // fixture — a scratch table a test or script creates, uses, then tears
+                // down. Its DROP is teardown, not a migration, so it must neither surface
+                // as a stale-table-reference nor leave the name unknown: keep it known and
+                // clear the drop provenance this file recorded for it. (A genuine dropped
+                // table stays stale because its DROP lives in a migration that never also
+                // CREATEs it — e.g. recall's `generation_queue`, dropped in 0198.)
+                for (const t of createdTables) {
+                    if (droppedTables.has(t)) {
+                        knownTables.add(t);
+                        if (dropProvenance.get(t)?.migrationFile === sqlFile.filePath) {
+                            dropProvenance.delete(t);
+                        }
+                    }
+                }
             }
             // 1b. ORM tables from code files — with provenance from the table-source registry
             for (const [filePath, fact] of perFile()) {
@@ -2312,6 +2435,42 @@ export function createSchemaReducer() {
                 const unknownRefs = allTableRefs.filter(ref => !knownTables.has(ref.table));
                 if (unknownRefs.length / Math.max(knownTables.size, 1) <= 10) {
                     for (const ref of unknownRefs) {
+                        // The table existed and was dropped in a migration — a stale code
+                        // reference, not a typo. Name the dropping migration and the tables
+                        // that migration introduced (evidence, not proof of a successor).
+                        const drop = dropProvenance.get(ref.table);
+                        if (drop) {
+                            const migrationName = drop.migrationFile.split('/').pop() ?? drop.migrationFile;
+                            const created = drop.createdInSameMigration;
+                            const msg = created.length > 0
+                                ? `${ref.table} was dropped in ${migrationName}; that migration creates ${joinEnglish(created)}.`
+                                : `${ref.table} was dropped in ${migrationName} and was not recreated.`;
+                            violations.push({
+                                file: ref.file,
+                                line: ref.line,
+                                column: ref.column,
+                                severity: 'critical',
+                                message: msg,
+                                rule: 'stale-table-reference',
+                                analyzer: 'schema',
+                                symbol: ref.table,
+                                resolution: {
+                                    action: 'update-stale-reference',
+                                    // The tables `created` are evidence the migration replaced the
+                                    // dropped table, not proof of a drop-in successor — schemas can
+                                    // be split or changed incompatibly, in which case the file must
+                                    // be removed rather than updated. The summary names them as
+                                    // context and leaves update-vs-remove to the reviewer.
+                                    summary: created.length > 0
+                                        ? `The table '${ref.table}' was dropped in ${migrationName}. That migration introduces ${joinEnglish(created)} — review this reference and update or remove it.`
+                                        : `The table '${ref.table}' was dropped in ${migrationName} and was not recreated — update or remove this reference.`,
+                                    symbols: created.length > 0 ? created : [ref.table],
+                                    files: [ref.file],
+                                    lines: [ref.line],
+                                },
+                            });
+                            continue;
+                        }
                         const suggestions = getNearestTableSuggestions(ref.table, knownTables, 2);
                         const msg = suggestions.length > 0
                             ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`